I, too, was having problems with logins, after updating my site from 1.3.8a to 1.3.9f. I am using a custom template.
I've had the problem of getting a 'security error', when trying to log in, after creating an account.
I've had the problem of not being able to log in - when I enter my email and password and try to log in, I just get sent back to the main page and I'm still not logged in.
And I've had the problem that when I try to create a new account, it does get created, but on the screen where it should show the 'Primary Address' used for this new account, it doesn't show any address at all. And, when clicking on 'Continue', it says this:
"Whoops! Your session has expired"
Here's what I did that fixed all of these problems on this site:
In the init_sessions.php file, I changed this line:
"session_set_cookie_params(0, $path, (zen_not_null($cookieDomain) ? '.' . $cookieDomain : ''));"
To this:
"session_set_cookie_params(0, $path, (zen_not_null($cookieDomain) ? $cookieDomain : ''));"
What's odd is that I've got another site that uses a very similar template (pretty much the same, just different colors), from the same author, and it works fine, without making this modification to the init_sessions.php file.
Could it be that this change (in init_sessions.php) works, because of something in one of the template files, that's not 'compatible' wtih something in 1.3.9f?
John